Protecting cardholder data during an electronic payment transaction is vital for all entities involved in the processing of that transaction. It was recently made public that in the fourth quarter of 2013 and throughout 2014, significant data breaches occurred at major national retailers. In each instance, cardholder account numbers, and associated cardholder personal data, were illegally obtained by malicious fraudsters, exposing millions of sensitive payment records to potential fraudulent use, including identity theft. As a result, each retailer experienced damages in terms of lost sales, fines, and potential lawsuits for alleged negligence with regard to payment security standards. Another serious consequence of such breaches is brand erosion.
Data breaches are not a new occurrence in the payments industry, but the increasing number of breaches that occur each year, their severity in terms of numbers of records obtained, and the speed and stealth with which such breaches occur is new.
It is not a matter of if a business will experience a breach, it's a matter of when. While it is impossible to eliminate the possibility of a data breach occurring, it is now possible to protect cardholder data integrity in the event of a breach through PCI-validated point-to-point encryption (P2PE). PCI-validated P2PE renders any potential cardholder data useless and void of value in the event of a data theft because the cardholder data cannot be decrypted.